| From | Greg Kroah-Hartman <> | Subject | [PATCH 3.13 017/149] sch_tbf: Fix potential memory leak in tbf_change(). | Date | Thu, 20 Mar 2014 17:03:00 -0700 |
| |
3.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
[ Upstream commit 724b9e1d75ab3401aaa081bd4efb440c1b3509db ]
The allocated child qdisc is not freed in error conditions. Defer the allocation after user configuration turns out to be valid and acceptable.
Fixes: cc106e441a63b ("net: sched: tbf: fix the calculation of max_size") Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com> Cc: Yang Yingliang <yangyingliang@huawei.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/sched/sch_tbf.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
--- a/net/sched/sch_tbf.c +++ b/net/sched/sch_tbf.c @@ -332,18 +332,6 @@ static int tbf_change(struct Qdisc *sch, qdisc_put_rtab(qdisc_get_rtab(&qopt->peakrate, tb[TCA_TBF_PTAB])); - if (q->qdisc != &noop_qdisc) { - err = fifo_set_limit(q->qdisc, qopt->limit); - if (err) - goto done; - } else if (qopt->limit > 0) { - child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit); - if (IS_ERR(child)) { - err = PTR_ERR(child); - goto done; - } - } - buffer = min_t(u64, PSCHED_TICKS2NS(qopt->buffer), ~0U); mtu = min_t(u64, PSCHED_TICKS2NS(qopt->mtu), ~0U); @@ -377,6 +365,18 @@ static int tbf_change(struct Qdisc *sch, goto done; } + if (q->qdisc != &noop_qdisc) { + err = fifo_set_limit(q->qdisc, qopt->limit); + if (err) + goto done; + } else if (qopt->limit > 0) { + child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit); + if (IS_ERR(child)) { + err = PTR_ERR(child); + goto done; + } + } + sch_tree_lock(sch); if (child) { qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
|